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The Director of Central Intelligence 


Washington, D.C. 20505 


Resource Management Staff IHC/MM 80-2408 


26 March 


MEMORANDUM FOR: Director of Central Intelligence on 

VIA: Deputy to the DCI for Resource M dagenent” is 
Trector, Information Resources Office 

SUBJECT: Project SAFE 

REFERENCE: A. Your memo of 21 March, Subject: Concern 


Regarding SAFE (Tab A) 


B. Memo fron hs i rman, STAP 
to DCI dt ar » subject: Questions 


Regarding SAFE (Tab B) 


1. I appreciate the opportunity to comment on the issues 
raised by the STAP Panel in connection with the SAFE Project. As 
background to our comments, I should point out that last year, 
after discussions between the D/DCI/RM, the DDCI, and DDA, it was 
determined that the focus of our interest in SAFE was to be "the 
areas of resource allocation and the relationship of SAFE to other 
programs on a Community-wide basis."* Although we have continued 
to review the development of Project SAFE, our primary attention 
has been in accordance with the above quoted limitations. Conse- 
quently, we are not prepared to comment, except in general terms, 
on many of the concerns raised in the referenced STAP memorandum. 


2. Of the four principal concerns listed in your memo of 
March 2ist, only one falls within the scope of IRO's responsi- 
bility as set forth in paragraph 1 above, namely: 


"What actions are underway to ensure that the Intelli- 
gence Community has access to CIA SAFE and that CIA SAFE 
has access to DIA SAFE as well as such systems as COINS 
and SOLIS?" 


*Memo from DDCI to D/DCI/RM dated 16 March 1979, Subject: Project 
SAFE 
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3. It is appropriate that your concerns along these lines 
be addressed because: 


o At the DCI's semiannual review in May 1979, it was 
stated that a direct physical link between the DIA 
and CIA systems would be provided. 


o Our review of the current version of the System 
Requirements Specifications indicates that such a 
communications connection between CIA and DIA SAFE 
systems is not included in the specifications. 


o I have discussed this deficiency to the attention of 
the SAFE Project Manager and he states that such a 
requirement will be added by amendment; that, 
although this has not yet been accomplished, such an 
amendment will be prepared in the near future. 


4. We believe that it is crucial to the ultimate development 
of the types of intercommunication which are set out in your 
subject memorandum that this requirement be now formalized in the 
SAFE documentation since, if properly specified, it will provide 
the technical capability to enable: 


o CIA analysts to access DIA files. 


o CIA analysts to access other Community files 
through the DIA SAFE interface with the COINS 
network which is included in the current 
requirements documents. 


o DIA analysts to access CIA SAFE files. 


o Analyst to analyst communications between DIA 
and CIA analysts. 


o The capability to permit other Intelligence 
Community components to access CIA SAFE facilities 
by going through the DIA interfaces with the COINS 
or AUTODIN networks. 


5. It should be noted that the provision of the physical 
links and the technical capabilities to accomplish the above 
listed functions will not, in and of itself, result in the 
implementation of any of these functions. None of the SAFE 
documentation, either emanating from DIA or CIA, calls for these 
functions to be provided. Indeed, the original CIA SAFE docu- 
mentation specifically provides that the CIA SAFE system will be a 
closed system accessible only by CIA personnel. The position has 
been taken by some that CIA has no validated requirement for 
access to any non-CIA system, including DIA SAFE. The results of 
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the IHC-sponsored Analyst Support Study indicate that this is 
probably not the case. Nearly half of the CIA analysts 
interviewed said they regularly access outside data bases such as 
SOLIS, the COINS files, CIRC II, and the NPIC data system. 
Furthermore, analyst-to-analyst communication across agency lines 
was ranked the second most important source of information by CIA 
analysts and the most important source by DIA analysts. As 
automated systems develop and improve and analysts become 
increasingly confident in their use of and reliance upon direct 
access to automated systems, requirements for and the value of 
access to external systems should increase still further. 


6. The management of the Consolidated SAFE Project Office is 
working under a handicap in this area. There has been, to our 
knowledge, no extensive formal review or update of CIA's 
functional requirements on the user side since the decision was 
made to combine the two programs. Without any formal statement of 
requirements from the CIA analytical community (primarily NFAC) 
which the system is designed to support, it is difficult for those 
charged with designing and implementing the system to anticipate 
what those needs may be. Therefore, we suggest that either you or 
some other appropriate authority should give to the SAFE Project 
Office some appropriate guidance which addresses these areas of 
concern. 


7. We would call to your attention the fact that providing 
any access to the CIA system from DIA and more especially from 
elements of the Intelligence Community outside of DIA raises 
serious security issues. The resolution of these issues will 
probably require action on your part to modify the present 
interpretation of existing security policies, or in some cases 
amendments thereto. If you should decide that the combined SAFE 
systems should provide the types of intercommunication and outside 
access which are outlined in your areas of concern, then someone 
(possibly the Computer Security Subcommittee of the DCI Security 
Committee) should probably be tasked with the responsibility of 
defining the security issues, suggesting possible solutions, and 
performing appropriate risk analyses so that they may be submitted 
to you for resolution. If this is undertaken, IRO should probably 
be involved in some way since decisions on these issues will 
undoubtedly have major long-term effects on the feasibility of 
improving the interagency exchange of information and could also 
have a substantial impact on the resources which will be needed to 
satisfy Community ADP requirements. 


8. General comments on other concerns expressed by you based 
upon our limited perspective are: 
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STATINTL o We are informed that a. ; OCR is coordinating 
the CIA user interface with the CSPO; that he is 
completely aware of the status of the project and 
consults regularly with the CSPO. 


o In the development of a project such as SAFE, it is 
extremely important that a well defined single point 
of contact between the users and developers be 
established and maintained. Otherwise, the system 
developers will be faced with conflicting statements 
of requirements. 


o If, in fact, the established lines of communications 
with the users are not adequate, perhaps the reason 
is attributable to a lack of an effective framework 
within NFAC to provide a continuing review of SAFE 
as it develops. If this is the case, we are not aware 
of it. 


0 We see no evidence that "major portions of the 
proposed operational capabilities are unspecified." 
It is, however, probably true that NFAC should direct 
more attention to the general issue of what its 
requirements for open source material are and how 
these should be met, either through SAFE or other 
means. 


o The decision to place SAFE on a design-to-cost basis 
necessarily implied some scaling down of the original 
requirements for the initial version. In consonance 
with this, NFAC did review and set priorities on the 
original SAFE requirements. 


o It is our assessment that the CSPO is proceeding with 
development so that NFAC's highest priorities will be 
met first and the design will accommodate the later 
addition of those functions which now enjoy a lesser 
priority. 


o If some of the capabilities which this approach will 
require to be deferred are considered to be important 
enough to warrant it, NFAC should develop a justifi- 
cation for their inclusion in the initial version of 
SAFE and the issue should be addressed during program 
review. 


9. In conclusion, I would take this Opportunity to inform 


you of two initiatives we are taking in conjunction with the IHC 
which may have an impact on the future development of SAFE. 
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o The development of a user language for SAFE will 
result in a common user language for DIA & CIA. 
We are exploring the possibility that this could 
become the initial step for developing user language 
standards for use throughout the Community. This will 
require the cooperation of the SAFE Project Office 
if it is to succeed. 


0 We expect the IHC to recommend the development 
of a distributed system of bibliographic informa- 
tion storage and retrieval systems. If this is 
to be done, the facilities of both the DIA & CIA 
SAFE systems in this area will have to function 
as part of an overall Community system. If this 
is to be accomplished, the interconnection of 
the two systems could t d_ importance. 


STATINTL 
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SUBJECT: Project SAFE 


Distribution: 


Orig - Adse 
1 - DDCI 
1 - DDA 
1 - DD/NFAC 
1 - D/ODP 
1 - D/CSPO 
1 - Executive Registry 
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21 March 1980 


MEMORANDUM FOR: Deputy Director for National Foreign Assessment 
Deputy Director for Administration 
Director of Data Processing 


FROM: Director of Central Intelligence 
SUBJECT: Concerns Regarding SAFE 


1. One of the subjects addressed at the recent Science and 
Technology Advisory Panel (STAP) meeting was the SAFE system and 
jts implementation. Several concerns were expressed at the meeting 
regarding SAFE, including the fact that there are no plans at present 


to connect CIA and DIA SAFE systems so that they are mutually accessible. 


I share several of the concerns expressed by the Science and Technoloay 
Advisory Panel, and accordingly would like to meet with you to address 
several of the issues that were raised by the Panel. I attach for your 
information and response a list of questions and concerns prepared by. 
the STAP relating to SAFE. While I would appreciate your being prepared 
to address all of these questions at our meeting, I: personally am 
especially concerned about the following: 


-- What actions are under way to ensure that the Intelligence 
Community has access to CIA SAFE and that CIA SAFE has access to 
DIA SAFE as well as such systems as COINS and SOLIS? 


-- How will SAFE deal with open source material? 


-~- As described in some detail on page 3 of the STAP paper, 
what actions are being taken to identify the real needs of the 
SAFE user community and will they be satisfied by the system? 


~- How can CIA make a reasonable evaluation of the current 
status of SAFE with major portions of the proposed operational 
capabilities either unspecified or not communicated to the 
Agency? 


I? 3 howe Fon 
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2. Iwill schedule a meeting to discuss these issues toward the 
end of next weex. In the meantime, I would appreciate your responding 
to all of the questions in the attached.paper and providing such responses 
to me by the middle of next waek for my use in preparation for the meeting. 


STATINTL 


STANSFIELD TURNER 


Attachment a/s 


cc: DDCI - 
DDS&T 
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Science and Technology Advisory Panel 


18 MAR 1930 


MEMORANDUM FOR: Director of Central Intelligence 
Deputy Director of Central Intelligence 


STATINTL FROM: 


STAP Chairman 


SUBJECT: | Questions Regarding SAFE 


1. In response to your request of March 14, 1980, 
| . for comments on the current status of SAFE, I attach a 
list of eight questions and brief comments that STAP 
believes should be addressed, 


7s STAP is continuing its analysis of the SAFE 
problem and will prepare an options paper within the next 
two weeks for your consideration. 


STATINTL 


Attachments: 
As Stated 
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1.0 What steps are being taken to ensure that the Agency, 
rather than the contractor is in control of the technical 
aspects of the design of the system? 


The geographic remoteness of the contractor, and the 
lack of continuing contractor-user interaction can lead to 
a situation in which the builder of the system also becomes 
the architect. The absence of reciprocal technical 
representation, like resident engineers, delays every 
routine decision and makes larger ones unresponsive to,’ 
Agency/community needs or technological constraints. Strong 
Agency technical management is absolutely essential if the 
system is to satisfy real and evolving agency needs and if 
it is to be integrated with other Agency and community 
resources. 


2.0 How is SAFE management ensuring that a final working 
system has been developed from the continuing evolution of 
an operationally valid pilot system? How has SAFE taken 
advantage of the. experience of similar, very large systems 
in their: 


_1) system architecture, 
2) communication and control, and 
3) changing performance requirements? 


How is SAFE management ensuring that the system will: 


1) make available data on operation and usage of the 
pilot system to guide development; 

2) be able to modify both system functions and 
interaction capabilities so as to ieee changing and evolving 
requirements; and 

3) be able to add new functions and interactions SO as 
to meet new requirements? 


Relevant Experience -- It is well agreed that an. 
information handling system cannot be achieved by a simple 
Design-Build-Use cycle, no matter how brillant the design 
or faithful the building. Consider three (out of many) 
currently operating very large nets with requirements at 


least comparable in size and CONDE aoTey with the Agency/ 
community's: 


1) the ARPA net, 


2) the airlines reservation system, and 
3) the IBM in-house computing net. 
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All of these systems evolved - that is, they started 
as soon as possible with operating pilot systems, so that 
there was always an operational: evaluation of effectiveness. 
Furthermore, in each case, a primary purpose of the original 
plans was drastically altered as experience was gained. Even 
so, developments in concept, hardware, software, and practice 
are continuing now in greater volume than ever. , 


2.1 Tne ARPA Net 


. 
. 


The ARPA net was originally conceived by ci 
at the ARPA IPO (Information Processing Office) as a means 


of netting research computers in order to do distributed 
computing. The message facility was then a minor function. 

As message usage rose, packet switching became a powerful 

tool with wide application elsewhere in the technology. ‘The 
separate centers in the ARPA net have much independence, 
subject to some fairly strict requirements for communications 
protocols and access. This allows competitive development 

and a common evaluation of new technological developments - 
e.g., the intelligent terminal is being subjected to widespread 
experimentation and development. 


2.2 Airlines Reservation System 


The first automated electronic airfare reservations and 
ticketing systems were disasters ~- e.g., SABER, the 
American Airlines/IBM effort was predesigned and built to 
an apparently reasonable set of specifications that turned 
out not at all to match the operational needs. The first 
successful ones were ad hoc temporary devices (@.g.5- UNITED) 
that worked just well enough to be improved. 


Note that the requirement for fast and accurate inter- 
line communications, backed up by automatic commitments’ for 
seats and equipment was a much later development; it is, however, 
by now one of the most valuable and cost-effective facilities. 


2.3 The IBM In-House Computing Net 


Virtually all the on-line computers at IBM company 
installations world-wide are netted together by communication 


| -2- 
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Lacilicies,; making them, 
the world. 
systems are: 


we believe, the largest net in 
Admirable new functions exhibited by their 


1) a modifiable macro command languaga, 


2) a consistent, Speedy and flexible data transmission/ 
translation scheme. 


3.0 The SAFE user community consists of intelligence.’ 
Community analysts covering the full 
into foreign political, military, economic, SCLENtLELG 
and technological activity. Their effective use of thi 
System and, ultimately, the quality of intelligence they 
produce rest on whether their 


real needs can be identified 
and satisfied by the system. To that end, what actions 


Spectrum of research 


Ss 


1) all elements of the intended use 


x community 
are actually involved in the system! 


Ss continuing development, 


2) the broadest of the present analytical requirements 
are identified, 


3) these present requirements can be validated by a 
consistent method, 


4) the validated present requirements will be met, 
5) modifications and new requirements can be accepted 
as they are identified, 

6) all analytical users will acquire the necessary 
skills and familiarization with SAFE on an interim basis so 


they are ready to begin broad utilization when system Ioc is 
reached, ‘+ 


7) this interim SAFE test-phase acquires continuing. 
comprehensive experimental data on user experience with the 
system, and 


8) the acquired data on user experience is actually 
utilized in the architecture and development of the system? 


ae 
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~ 4.0 How can the Agency make a reasonable evaluation of 

Current status of SAFE with major portions of. the proposed 
operational capabilities either unspecified or uncommunicated 
to the Agency? For example, 


the 


1) the user command language and its parsing, 

2) the user programming languages, 

3) the user editing languages, and ‘ 

4) procedures for backup, including regeneration ‘or 
derived files lost in crashes. 


Note the above have to be prototyoves ca 


pable of continuing 
responsive evolution, rather th 


an final imposed prescriptions. 


5.0 What actions are under way to insure that the Intelligence 
Community has access to CIA SAFE and that CIA SAFE has access 
to DIA SAFE as well as such systems as COINS an& SOLLS? — 


The absence of appropriate linkages with other IC systems 
makes it highly probable that duplicate facilities and files 
Will be acquired and constructed with higher costs and lessened 
capability for the total IC system. Provisions for such 
linkages should be built into SAPE from the Start, otherwise 
it will be difficult if not impossible to backfit these 
Linkages. i STATSPEC 


6.0 How will SAFE deal with open source material? Will 
material, either finished publications or field reporting, 

be made available to the analyst through SAFE? How will SAFE 
deal with current newspaper and journal entries? 


Several of the offices that will use SAFE, in particular 
OPA and OSWR, make extensive use of open source material. 
Their analytical efforts will be seriously hampered if’ their 
files do not include open source materials. 


7.0 What steps are being taken to ensure that SAFE will be 
designed to allow collaborative usage? 


Examination of other similar systems, such as Stanford 
University's SUMEX system or the internal IBM system, shows 


aA 
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that user-to-user interactions comprise a significant 
fraction of the total use of these systems and greatly 
enhance the overall analytical capability of its users. 


8.0 What steps are under way to ensure that in the 
procurement of major hardware items, these items will pe 
compatible with existing Agency systems? 


The Agency has made very substantial investment in 
ADP equipment that currently serves a wide variety ox 
users. This investment should be capitalized on in order 
to enhance the future capabilities and particularly the 
flexibility of SAFE, If the interoperability of SAFE and 
existing ODP hardware is. going to be dependent on software 
then provisions should be made: 


1) for the development of the needed software since 
it will be a major undertaking; and 


2) for the establishment of evolving standards and 
protocols for interconnection. 
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